Last week, the European Commission (EC) released a draft revision of its 1995 data protection rules for the stated purpose of strengthening online privacy rights and Europe's digital economy. But the rules threaten the viability of data-driven businesses, from Google to credit bureaus, critics contend.

The EC says that a single streamlined set of rules will save businesses billions in administrative work. The rules require: notification of national data authorities as soon as possible following a serious data breach; explicit rather than assumed consent for data collection; easier consumer access to data and easier transfer of that data to other providers; and support for a "right to be forgotten," which gives consumers the option under some circumstances to have their data deleted from third-party service providers.

The fine for violating these European Union (EU) data rules is substantial: up to 1 million Euros or up to 2% of global annual revenue. Under this regime, Google's collection of Wi-Fi network data through its Street View cars, disclosed in 2010, could have cost the company $586 million, had the EU chosen to punish the company to the full extent of the law.

[ Sometimes data protection means less privacy. Read Stolen iPhone Saved By iCloud. ]

Google helped lead the protest against SOPA and PIPA, U.S. legislation that would have harmed the Internet and forced Internet companies to protect content companies. The EU data rules don't threaten the flow of information in the same way. Rather, they threaten the existence of information online, through rules like Article 17, the "right to be forgotten and to erasure," and Article 20, which forbids the exclusive use of automated data processing for determining, among other things, creditworthiness or work performance.

Try to imagine an information economy starved of information. The concept clearly has potential problems.

"Article 17 will give EU residents an unprecedented inalienable right to control and delete facts that were once voluntarily communicated by the subject," explained Jane Yakowitz, visiting assistant professor of Brooklyn Law School, in an online post.

EU justice commissioner Viviane Reding described that right thus in a statement last week: "If an individual no longer wants his personal data to be processed or stored by a data controller, and if there is no legitimate reason for keeping it, the data should be removed from their system."

Article 17 has some limits. The proposed rules recognize that people can't have the right to erase history, hinder free expression, harm public health, or impede scientific research with their desire to delete their data.

But Yakowitz argues the limits are undermined by restrictive wording and draconian fines.